![[MoeCTF 2025]mazegame_WP](http://pic.xiahunao.cn/yaotu/[MoeCTF 2025]mazegame_WP)
通过搜索算法解出最优路径的题目平台MoeCTF方向逆向知识点BFS、DFS难度入门一、信息获取题目意图就是让输入字符串走迷宫二、分析从下面分析发现n0x37为行数我更名为rown32为列数我更名为column终点为1532flag的内容为走出迷宫的路径这里可以直观的看出W、A、S、D对应的行和列的变化下面是找地图这里被打了问号是因为要在程序运行的时候这个数组才被赋值而现在是静态分析就没有初始值但是在左边可得知其被sub_1400010E0这个函数引用了因此地图就在这个函数里面打开就有地图了复制下来就行三、EXPfromcollectionsimportdequemap[11111111111111111111111111111111111111111111111111111111,10100000000000000010000011011101011111111101011100000111,10111010111111111010111011000001000001000001000101110111,10000010000010000010001011011111111101110111011101110111,10111111111011101110111011010000000000010100010001110111,10100000001000101000100011010101111111011101110101110111,10101011111110111011101011010101000001000000010101110111,10101010000010100000101011110101110101111101111111110111,10111010111010101111101011100101000100000101000101110111,10000010001010001000001011001111011111010101011101110111,11111011101011111011111111101000100000101100101001110111,10001010001000100010000010001010011000100010010011000001,10111010111110101010111011011001011111010101011101011101,10001010001000001010001011000101000100000101000101011101,11101011101111111011101011110101110111111101110101011101,10001000101000001010001011000100010100000101000101011101,10111111101011101110111011011111110101110111011101011101,10001000001000100000001011000100000100010000000101011001,11101011111011111111101011110101111101111111110101011011,10101000000010001000101011010100000001000100010101011011,10101111111110101010101011010111111111010101010101011011,10100000000000100010101011010000000000010001010101011011,10111111111111111110111011011111111111111111011101011011,10000000001111000000000011110111010000111100011111011011,11101111100000011011011111111010110111011101100001011011,11101111111111111011011111111101110111101101100001011011,10001000111111000010000011111010110111011101100001011011,10111010111111111010111011110111010000111101100001010011,10000010000010000010001011111111111111111101100001010111,10111111111011101110111011110001000110001101100001010001,10100000001000101000100011110111011101111101100001011101,10101011111110111011101011110001000101111101100001011101,10101010000010100000101011111101011101111101100001011101,10111010111010101111101011110001000110001101100001011101,10000010001010101000001011111111111111111101100001011101,11111011101011111011111110000000000000001101100001011101,10001010001000100010000011111111111111111100110011011101,10111010111110101010111010010000000011111110001111011101,10001010001000001010001010110111000001111110100101011101,11101011101111111011101000110011001111111100110111011101,10001000101000001010001011111111111111111111110111010001,10111111101011101110111010100001001100000000000011011011,10001000001000100000001011111111111101011101111001011011,10101011111011111111101011000000000001000100010111011011,10101000000010001000101010010111111111111111111111011011,10101111111110101010101010110111111111111111111101011011,10100000000000100010101011100000000000000000000011011011,10111111111111111110011011111111111111111111111011011011,10000011111111111111000010000000000000000000000000011001,11111011111111111111111111111111111111111111111111111101,11111011100001100110110111000000000000000000000111111101,11111011101111011010000111011111111111111111110111111101,11111011100001000010110110000111111111111111110000000001,11111011101111011010110111101111111111111111111111111111,11110000000000011000110000000000000000000000000000000011,11111111111111111111111111111111111111111111111111111111,]start(1,1)#行列goal(15,32)moves[(W,-1,0),(S,1,0),(A,0,-1),(D,0,1)]qdeque([(start[0],start[1],)])seen{start}whileq:r,c,curq.popleft()if(r,c)goal:pathcurbreakforch,dr,dcinmoves:nr,ncrdr,cdcifnot(0nr55and0nc55):continueifmap[nr][nc]1or(nr,nc)inseen:continueseen.add((nr,nc))q.append((nr,nc,curch))print(path)print(fmoectf{{{path}}})使用广度优先搜索寻找flag四、总结1.我觉得要注意ida给的十六进制数这个可能是数字也可能是对应的ASCII如果判断错误会给使代码理解出现错误看到 32 到 126 之间的立即数先想一下 ASCII。常见的就这几个0x30–0x39 是 ‘0’–‘9’0x41–0x5A 是 ‘A’–‘Z’0x61–0x7A 是 ‘a’–‘z’。在 IDA 里对这个数按 R可以直接切成字符看。2.不重要的变量可以直接忽略
通过搜索算法解出最优路径的题目平台MoeCTF方向逆向知识点BFS、DFS难度入门一、信息获取题目意图就是让输入字符串走迷宫二、分析从下面分析发现n0x37为行数我更名为rown32为列数我更名为column终点为1532flag的内容为走出迷宫的路径这里可以直观的看出W、A、S、D对应的行和列的变化下面是找地图这里被打了问号是因为要在程序运行的时候这个数组才被赋值而现在是静态分析就没有初始值但是在左边可得知其被sub_1400010E0这个函数引用了因此地图就在这个函数里面打开就有地图了复制下来就行三、EXPfromcollectionsimportdequemap[11111111111111111111111111111111111111111111111111111111,10100000000000000010000011011101011111111101011100000111,10111010111111111010111011000001000001000001000101110111,10000010000010000010001011011111111101110111011101110111,10111111111011101110111011010000000000010100010001110111,10100000001000101000100011010101111111011101110101110111,10101011111110111011101011010101000001000000010101110111,10101010000010100000101011110101110101111101111111110111,10111010111010101111101011100101000100000101000101110111,10000010001010001000001011001111011111010101011101110111,11111011101011111011111111101000100000101100101001110111,10001010001000100010000010001010011000100010010011000001,10111010111110101010111011011001011111010101011101011101,10001010001000001010001011000101000100000101000101011101,11101011101111111011101011110101110111111101110101011101,10001000101000001010001011000100010100000101000101011101,10111111101011101110111011011111110101110111011101011101,10001000001000100000001011000100000100010000000101011001,11101011111011111111101011110101111101111111110101011011,10101000000010001000101011010100000001000100010101011011,10101111111110101010101011010111111111010101010101011011,10100000000000100010101011010000000000010001010101011011,10111111111111111110111011011111111111111111011101011011,10000000001111000000000011110111010000111100011111011011,11101111100000011011011111111010110111011101100001011011,11101111111111111011011111111101110111101101100001011011,10001000111111000010000011111010110111011101100001011011,10111010111111111010111011110111010000111101100001010011,10000010000010000010001011111111111111111101100001010111,10111111111011101110111011110001000110001101100001010001,10100000001000101000100011110111011101111101100001011101,10101011111110111011101011110001000101111101100001011101,10101010000010100000101011111101011101111101100001011101,10111010111010101111101011110001000110001101100001011101,10000010001010101000001011111111111111111101100001011101,11111011101011111011111110000000000000001101100001011101,10001010001000100010000011111111111111111100110011011101,10111010111110101010111010010000000011111110001111011101,10001010001000001010001010110111000001111110100101011101,11101011101111111011101000110011001111111100110111011101,10001000101000001010001011111111111111111111110111010001,10111111101011101110111010100001001100000000000011011011,10001000001000100000001011111111111101011101111001011011,10101011111011111111101011000000000001000100010111011011,10101000000010001000101010010111111111111111111111011011,10101111111110101010101010110111111111111111111101011011,10100000000000100010101011100000000000000000000011011011,10111111111111111110011011111111111111111111111011011011,10000011111111111111000010000000000000000000000000011001,11111011111111111111111111111111111111111111111111111101,11111011100001100110110111000000000000000000000111111101,11111011101111011010000111011111111111111111110111111101,11111011100001000010110110000111111111111111110000000001,11111011101111011010110111101111111111111111111111111111,11110000000000011000110000000000000000000000000000000011,11111111111111111111111111111111111111111111111111111111,]start(1,1)#行列goal(15,32)moves[(W,-1,0),(S,1,0),(A,0,-1),(D,0,1)]qdeque([(start[0],start[1],)])seen{start}whileq:r,c,curq.popleft()if(r,c)goal:pathcurbreakforch,dr,dcinmoves:nr,ncrdr,cdcifnot(0nr55and0nc55):continueifmap[nr][nc]1or(nr,nc)inseen:continueseen.add((nr,nc))q.append((nr,nc,curch))print(path)print(fmoectf{{{path}}})使用广度优先搜索寻找flag四、总结1.我觉得要注意ida给的十六进制数这个可能是数字也可能是对应的ASCII如果判断错误会给使代码理解出现错误看到 32 到 126 之间的立即数先想一下 ASCII。常见的就这几个0x30–0x39 是 ‘0’–‘9’0x41–0x5A 是 ‘A’–‘Z’0x61–0x7A 是 ‘a’–‘z’。在 IDA 里对这个数按 R可以直接切成字符看。2.不重要的变量可以直接忽略
